CVE-2024-42461 Elliptic allows BER-encoded signatures
The Elliptic library allows ECDSA signature malleability via BER-encoded signatures, potentially causing issues in systems relying on strict signature uniqueness.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42461?
CVE-2024-42461 is a medium-severity vulnerability in n/a, published on 2 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
Weakness: CWE-347
Which versions are affected by CVE-2024-42461?
2 open source packages ship an affected version, including elliptic. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
elliptic npm | From 5.2.1 | 6.5.7 |
elliptic npm | From 5.2.1 | 6.5.7 |
Products include Elliptic Project Elliptic.
How do I fix CVE-2024-42461?
Upgrade elliptic to 6.5.7 or later.
Is CVE-2024-42461 being exploited?
There is no known exploitation of CVE-2024-42461 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as AZL-47425, DEBIAN-CVE-2024-42461, GHSA-49q7-c7j4-3p7m, UBUNTU-CVE-2024-42461.